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FOREWORD 


This report contains the plans and results for the verification activities of the Space Station Freedom Program’s 
(SSFP) electric power system (EPS). In April 1993, following the development test phase of the program, an 
effort to redesign Space Station Freedom (SSF) was initiated, and at the time of this writing, plans for a newly 
designed space station were being completed. This paper will only address the state of the SSF verification test 
program prior to restructuring. 

Although SSF will soon be redesigned, it will be an unmatched scientific facility orbiting high above the 
Earth, providing a unique research environment. Its primary goal will be to advance scientific and technological 
research by the year 2000. Presently, under the management of NASA Lewis Research Center, Rocketdyne is 
responsible for the design, development, test, and verification of the EPS. 


« 
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Daniel S. Rylicki and Frank Robinson, Jr. 
National Aeronautics and Space Administration 
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SUMMARY 

Space Station Freedom’s (SSF) electric power system (EPS) hardware and software verification is per- 
formed at all levels of integration, from components to assembly and system level tests. Careful planning is 
essential to ensure the EPS is tested properly on the ground prior to launch. The results of the test performed on 
breadboard model hardware and analyses completed to date have been evaluated and used to plan for design 
qualification and flight acceptance test phases. These results and plans indicate the verification program for SSF’s 
75-kW EPS would have been successful and completed in time to support the scheduled first element launch. 


INTRODUCTION 

Space Station Freedom is the most complex spacecraft ever designed and consists of eight systems devel- 
oped by three contractors and NASA centers and the international partnership with Japan, the European Space 
Agency, and Canada (figs. 1 and 2). The systems are categorized into three groups: avionics that consist of the 
data management system (DMS), communications and tracking (C&T), and guidance, navigation, and control 
(GN&C); utilities that consist of the electric power system (EPS), the thermal control system (TCS) and the envi- 
ronmental control and life support system (ECLSS); and the crew systems that consist of man systems (MS) and 
the extravehicular activity system (EVAS). Because of the system interdependencies and sequential assembly 
process of SSF, each successive mission essentially constitutes a new spacecraft. As such, a rigorous test and 
verification program must be performed according to the scheduled program milestones (fig. 3). 

The NASA Lewis Research Center and the Rocketdyne Division of Rockwell International are responsible 
for the design, development, test, and verification of the electric power system. The tests and verification will be 
performed at Rocketdyne, Lewis, and other team member facilities during the five phases of verification: devel- 
opment, qualification, acceptance, prelaunch, and on-orbit (fig. 4). Applicable submittal standards mandate each 
test contain a requirements document, plan, and report. All hardware and software will be verified by analysis, 
test, demonstration, inspection, or a combination of these. 


DEVELOPMENT 

The development phase activities for SSF’s EPS, which included the analysis and testing of various design 
requirements, was focused on the verification of the design approach. This phase also consisted of establishing a 
baseline for the program requirements documents and plans and lower level work package and contractor docu- 
mentation. Since the organizational structure of work package-04 (WP-04) included the Photovoltaic (PV) and 
Electrical Systems Divisions (ESD), the development phase activities were also divided between the PV and 
ESD groups. 

Rocketdyne’ s verification analysis at the orbital replacement unit (ORU), the combined assembly, launch 
package, and PV module levels were all managed by the PV Division. No testing was performed prior to the 
preliminary design review (PDR). However, following PDR, development testing was performed on breadboard and 
engineering model (EM) hardware, structural models, and mass and thermal acoustic models. Test objectives were 
to evaluate the functional and environmental compliance of the hardware and software to performance requirements. 


The ESD required significantly more breadboard and EM hardware development tests. This hardware was 
designed and evaluated at Rocketdyne’s Electronics Laboratory, with the actual breadboard development testing 
performed at the Space Power Electronics Laboratory (SPEL). Two phases of SPEL testing occurred: system 
integration and proof-of-concept. The system integration phase verified hardware and software integration, in 
addition to demonstrating system electrical and control functionality (i.e., fault protection, power quality, stabil- 
ity, and performance). The proof-of-concept phase was established to perform system level functional tests, 
which were used to test system and ORU level functional performance parameters. 

The results from development test activities were used to validate the design, mathematical models, and 
analysis. If development tests had been intended for certification, the test would have been "predeclared" a 
qualification test prior to its start. 


Qualification 

Most of the design and performance requirements are formally verified in the qualification phase. Qualifi- 
cation represents the broadest scope of verification within design tolerances to which a component is subjected. 
This phase verifies that the design conforms to all requirements when subjected to environmental and life-cycle 
conditions. Qualification hardware and software have the same configuration and manufacturer as the flight 
hardware and software. Flightlike hardware and software, which is form, fit, and function, are used to resemble 
any interface and can be verified by analysis, test, inspection, demonstration, or a combination of these. 

Following qualification testing, Rocketdyne submits reports of test results to NASA for a "closeout" of 
program requirements. The test report number associated with the closeout of a particular requirement is archived 
in the EPS data base verification module and uploaded in the program’s master verification data base system 
(MVDS) by a transitional data base developed at Lewis. This information supports hardware and software certi- 
fication activities and design reviews. 

Qualification for the EPS PV hardware and software is performed at Martin Marietta for the integrated 
equipment assembly (IEA); at the Lewis Space Power Facility (SPF) for solar power module (SPM) testing, and 
at Johnson Space Center for SPM modal testing. Orbital replacement unit testing is performed at Rocketdyne 
and the responsible subcontractor facility. Orbital replacement unit testing consists of environmental, electro- 
magnetic interference/electromagnetic compatibility (EMI/EMC), and electrical functional. 

Electrical system hardware and software are verified during electrical system integrated test (ESIT) activi- 
ties at both SPEL and the Power Systems Facility (PSF) at Lewis. 


Acceptance 

During the acceptance phase of the program, WP-04 determines through testing and analysis that the EPS 
flight-developed hardware and software meet the specified design and performance requirements. 

Integrated assembly and checkout (LACO) of the PV module, the integration of all assemblies into the on-orbit 
assembly configuration and prepared for launch into the cargo element, is performed by WP-04 during the accept- 
ance phase. Final hardware and software checkout also occurs at this time. After LACO is performed at the PSF, 
the cargo element is shipped to the NASA John F. Kennedy Space Center. 
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Prelaunch 


Prelaunch or launch processing phase activities are performed at Kennedy and are designed to ensure that 
the SPM cargo element (fig. 5) is capable of performing its intended functions. After the cargo element inspec- 
tion is conducted, a prelaunch test of the first two on-orbit stage configurations, including one WP-04 PV 
module, is performed. This stage configuration test, called the stage 2 test, is designed as a "low-power" test to 
verify the physical and functional interfaces of the spacecraft. 


On-orbit 

The on-orbit phase verifies the spacecraft’s successful buildup, checkout, demonstration, performance, and 
operation. Data are retrieved through the use of built-in tests and actual on-orbit demonstrations to validate 
mathematical models, analyses, simulations, demonstrations, and test results obtained on the ground. 


SPACE STATION FREEDOM PROGRAM OFFICE 

The Space Station Freedom Program (SSFP) Office, located in Reston, Virginia, comprises seven divisions 
with verification duties. Of the seven, three have associated verification tasks: the Systems Engineering and 
Integration (SE&I) Office, the Utilization and Operations Office, and the Avionics Systems Office. The SE&I 
Office is responsible for the development of the verification requirements and implementation; however, the 
implementation of these requirements is managed from the Marshall Space Flight Center. The Utilization and 
Operations Office manages payload and ground operations integration and verification. The Avionics Systems 
Office manages avionics integration and verification and the software independent verification and validation 
(IV &V) requirements and plans (fig. 6). 

Verification requirements are defined in section 12 of Space Station Program (SSP) 30000, "SSF Program 
Definition and Requirements Document" (PDRD). These requirements are implemented in SSP 30666, "Program 
Master Verification Plan" (PMVP) (fig. 7), which defines the verification of hardware and software design and 
performance requirements. 

In addition to defining verification requirements, the SE&I Office establishes the program verification 
policies, goals, and objectives. To meet verification program milestones and to improve communication and 
integration between work packages, weekly telecons were established. The SE&I Office also administers the 
Program Verification Panel (PVP), a level II working group designated to resolve issues and concerns pertaining 
to verification. The MVDS, one of the group’s main working tools for the implementation process, is used to 
confirm that all SSF requirements have been verified at all levels. 


Distributed System Architects 

Since the functional systems of SSF (e.g., EPS and DMS) are distributed, the level II end-to-end systems 
are independently verified by Distributed System Architects (DSA). Level II verification plans for the distributed 
systems are located in the architectural control documents (fig. 8). Each DSA is responsible for ensuring that 
required system verification information from other work packages and international partners be obtained. This 
information is documented in a "Verification Completion Notice" (fig. 9), uploaded into the MVDS in prepara- 
tion for the Certification of Flight Readiness (CoFR) process, and documented in a separate plan for each dis- 
tributed system. 
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Technical Disciplines 


Technical disciplines (TD) are responsible for managing the tasks in figure 10. Their role is similar to the 
DSA’s verification of level II requirements for their specific discipline, in that they must also complete verifica- 
tion completion notices for MVDS uploading in support of the CoFR process. Like the distributive system veri- 
fication plans, there are also technical discipline verification plans. 


ELECTRICAL SYSTEMS VERIFICATION 

The Electrical Systems Division’s ORU’s are located throughout SSF and are connected to provide power 
to the station and its users. The ORU’s are verified at the box level for different environments and interfaces 
and as part of the integrated end-to-end system level EPS tests. Environmental testing is conducted on each 
ORU during the development, qualification, and acceptance phases. EPS system level tests from the energy 
source to the user loads are performed in the WP-04 electrical system testbed, in SPEL and later in PSF. 

The orbital replacement unit fidelity used in the development phase is both breadboard and engineering 
model hardware. The qualification phase uses breadboard, engineering model, and flightlike hardware, and the 
acceptance phase exclusively uses flight hardware. Design qualification is completed on individual ORU’s with 
prototype hardware and is then certified for flight worthiness following the completion of acceptance phase test- 
ing. Results from the ORU and system level tests are used to validate and update verification analyses models. 

Proof-of-concept breadboard testing is conducted at SPEL (see the following section). Higher fidelity hard- 
ware is integrated into SPEL/ESIT (see the Electrical System Integrated Test section) during which the EPS is 
qualified and flight software is validated (see the Electrical Power System Software Verifiction section). After 
the completion of system level qualification testing at SPEL on the SSF configuration that constitutes the first 
six scheduled assembly flights, the testbed is moved to the PSF at Lewis. The testing conducted at PSF is used 
to sustain engineering activities for space station configurations that are expected after the sixth launch. 

Some power management and distribution (PM AD) ORU’s are delivered to other Space Station Freedom 
program participants (SSFPP) to support their verification activities. Engineering model hardware is sent to sup- 
port assembly level acceptance testing; only performance and functional testing is conducted on the assembly 
elements when the flight hardware is integrated and outfitted. 


Electrical System Division Verification Results to Date 

The ESD development plans for each ORU were to manufacture and test both breadboard and EM fidelity 
hardware. Breadboard models were produced and tested first. For most breadboard ORU’s, only electrical func- 
tional tests were conducted before being taken to SPEL to be integrated into the testbed. Engineering model 
hardware was to have electrical and environmental tests performed. Specific environmental tests were random 
vibration, thermal cycle, and thermal vacuum. Finally, EMI/EMC tests were performed. An exception was a 
breadboard remote power controller module (RPCM) that was exposed to limited thermal testing in order to 
gather data for updating analyses models. 

Electrical component testing also comprised a large part of the development phase. Problems or failed test 
requirements usually resulted from limitations in the breadboard hardware. All deficiencies were addressed by 
component modifications, upgraded hardware, or specification changes. Overall, the unit’s performance was not 
affected adversely by requirement noncompliances. The noncompliances were documented and forwarded along 
with the hardware to SPEL for integrated system testing. 
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The proof-of-concept system level breadboard testing was to be conducted in a sequence of three tests 
spanning over 2 years beginning with the completion of PDR and concluding prior to the start of the critical 
design review (CDR). Test results from observing system interdependencies were used to evaluate the design 
and determine how to operate the system on-orbit. 

The SPEL test 1 configuration (fig. 11) represented a simplified one-channel PV module architecture con- 
sisting of a solar array and two battery-energy-source simulators, a breadboard sequential shunt unit (SSU), a 
direct-current switching unit (DCSU), and two battery control discharge units (BCDU). Advanced development 
software was used in the photovoltaic controller unit (PVCU). 

The SPEL test 1 evaluated power output, power quality, communications, and fault management. The power 
output test demonstrated successful EPS orbital performance during nominal isolation and eclipse phases. Steady- 
state and transient energy source control tests were conducted by operating the SSU and BCDU under various 
load conditions to demonstrate system response and power quality. Communications tests consisted of sending 
commands to the breadboard ORU’s and monitoring the feedback. Minimal fault testing was performed as a 
result of the breadboard hardware limitations. 

Most SPEL test 1 results were expected with the exception of those tests performed on the BCDU. The 
problems associated with the BCDU were analyzed, and design modifications to the unit resulted. Other minor 
problems and anomalies linked to the support equipment and system-under-test hardware and software will be 
corrected and retested as higher fidelity hardware and software is integrated into the testbed. 

The configuration for SPEL test 2 was the same as that used in test 1 with the addition of a breadboard 
main bus switching unit (MBSU) and direct current to direct current converter unit (DDCU) (fig. 12). A new 
version of the software, upgraded breadboard hardware and a prototype DMS kit were also integrated and tested 
in the SPEL test 2 configuration. This test examined primary power output requirements, power quality require- 
ments, fault protection, communication functions, and it validated the recommended SPEL test 1 design modifi- 
cations to the BCDU. 

The power output tests measured the performance of the system during isolation, eclipse, and transition 
orbital phases. Specific tests focused on the operation of the DDCU, SSU, and BCDU. The array and battery 
source simulators were programmed for a range of steady-state and transient load conditions. The current and 
voltage output of the ORU’s under test were monitored during nominal battery charge and discharge for the 
changing load conditions. Fault tests were performed to demonstrate the response of each breadboard ORU in 
the system under test. These tests showed the ORU’s ability to detect and isolate faults, thus protecting the 
power system. The communications tests demonstrated EPS software- and firmware-executed commands sent by 
tier I through the DMS kit. 

The results of SPEL test 2 revealed problems encountered during the fault tests. Some minor software prob- 
lems occurred during the power output tests and these problems were corrected during the test with updated 
software. Power output tests showed that power quality requirements were met and system stability maintained. 
Approximately 90 percent of the many commands issued during the communications tests were completed suc- 
cessfully and all test anomalies and problems were documented. Fault tests were performed successfully on 
upgraded hardware during SPEL test 3 to address those problems encountered in test 2. 

SPEL test 3, the SSF EPS proof-of-concept test, was originally scheduled to be completed before the WP-04 
CDR but did not conclude until several months later. SPEL test 3 objectives were to evaluate primary power 
output, secondary power, power quality and stability, system protection, redundancy and fault tolerance, and 
management and control. The test configuration for SPEL test 3 consisted of the ORU’s and simulators present 
in tests 1 and 2, and a representation of the secondary/tertiary distribution system including RPCM’s (fig. 13). 
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Similar to SPEL test 2, the power outputs of the SSU, BCDU, and DDCU’s were observed over a range of 
voltages and currents in the battery charge (insolation) and discharge (eclipse) phases. The two tests were then 
combined in a complete orbital test that continuously exercised the ORU’s from insolation through transition to 
the eclipse phase of an orbit. The response of the system was measured during fault tests performed to analyze 
system protection capabilities. The power quality was maintained during orbital transition tests and requirements 
were met during the fault tests. Management and control capabilities were tested by sending commands to 
ORU’s and monitoring the response. 

With the exception of the fault tests on the MBSU, BCDU, and SSU, the results for SPEL test 3 were gen- 
erally expected. All results were documented in summary test reports and nonconformance reports for those tests 
not meeting system performance requirements. Nonconformances were reviewed, appropriate changes in hard- 
ware and software requirements were made, and the tests were reconducted. Anomalies in the BCDU during 
power output tests were corrected, and the BCDU was successfully retested. 

SPEL test 4 was an add-on proof-of-concept test that was conducted after the WP-04 CDR to determine 
incomplete man-tended capabilities (MTC) objectives and configurations. The tests were to be completed by the 
end of September 1993 followed by testing for facility preparation and integration for design qualification. The 
system under test built upon the SPEL test 3 configuration. A third BCDU and battery simulator were added in 
parallel to the previous two, in addition to a second MBSU with two internal DDCU’s paralleled from each 
MBSU. This is the first configuration that simulates two simplified power channels. 

SPEL test 4 tested three BCDU’s operating in parallel, DDCU’s paralleled from separate channels, and the 
restart of one power channel from another, and removed discrepancies from SPEL test 3. Primarily the same 
tests will be run in SPEL test 4 as in SPEL test 3: primary and secondary power output, power quality, system 
protection, redundancy and fault tolerance, and management and control. 

Electrical System Integrated Test 

Integrated system level verification and validation tests are supported by SPEL/ESIT. The tests are divided 
into major phases that span over 3 years. Besides EPS design verification and validation, the electrical interfaces 
and functions with other space station elements are verified. Objectives of the tests focus on verifying power 
performance, control, and system protection and include verifying system stability and power quality on the 
primary and secondary power distribution systems and validating software control operations and fault tests. 

An early test phase concentrates on battery performance. The battery simulators used in early SPEL tests 1 
to 4 are replaced with engineering model batteries. This phase conducts tests that were performed with the bat- 
tery simulators during SPEL tests 1 to 4 and collects data to compare and correlate the performances of the 
battery simulators with EM batteries. Another important phase tests the EPS in each stage configuration, includ- 
ing tests of EPS operations: startup, shutdown, and restart. The testbed remains at Rocketdyne for testing 
through the MB-06 flight configuration and then moves to the Lewis PSF. 

The primary testing configurations will represent two EPS channels. Testing is initiated with the flight 
software, containing one EM channel and one breadboard hardware channel. As the test phases progress and 
qualification hardware becomes available, the hardware is integrated in the testbed, replacing the breadboard 
hardware. The EM batteries will be available for a brief testing period before they are replaced by the battery 
simulators. The other energy sources (solar arrays) will be simulated. Likewise simulated loads will be used 
during the test with the opportunity to test actual loads from other available systems. 
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Secondary and tertiary power distribution architectures represent WP-01 and -02 element configurations. 
Early planning to test these architectures as part of the end-to-end electrical power system required that inter- 
national partner switchgear controllers be integrated in the SPEL testbed. High on the priority list of tests to be 
performed with the switchgear hardware is fault testing to ensure that the required system protection, system sta- 
bility, and power quality be maintained. 


SOLAR POWER MODULE VERIFICATION 

The SPM provides the hardware and software required to collect, store, convert, and distribute electric 
power. The starboard SPM includes two photovoltaic (PV) modules while the port SPM includes only one PV 
module by the permanent manned capability phase. The port SPM is scarred for "growth" to add another PV 
power module. The PV power module consists of two beta gimbal/photovoltaic array assemblies (BG/PVAA), 
two beta gimbal transition structures (BGTS), one integrated equipment assembly (IEA) and associated integra- 
tion hardware. Testing for the SPM will be performed at the ORU, subsystem, and system hardware fidelity 
levels. 


Verification Test Results to Date 
Analyses to be performed for the SPM are 


Thermal models Maintainability 

Reliability Safety 

Functionality Environmental 

Space station operation Interface 

Mass properties Structural 

Performance 

Developmental test activities are in process for the three-bay deployable and retractable mast (FASTMast), 
BG-bearing life cycle, and energy storage. Currently these test are all progressing according to schedule without 
any significant problems. 

The FASTMast test verifies certain modes of failure for the test hardware. Each array is supported by a 
FASTMast that is approximately 1 10 ft long and consists of 32 bays, each 30.4 by 40.5 in. (fig. 14). The FASTMast 
is the primary structural member that must resist any loads imposed on the arrays. All tests performed to date 
on the three-bay FASTMast were configured using an eccentric axial compressive load sufficient to simulate 
longeron compression resulting from limit and ultimate bending moments. 

The results of the axial tests show good agreement between test and analytical data that predicted longeron 
loads. The actual test data showed that the FASTMast sustained these loads without buckling. Measured deflection 
data and visual inspections gave no indication of any pin/joint damage or yielding along the critical longeron 
load path. 

For the shear test, a shear load was applied at the top of the three-bay test mast with the axial and torsional 
loading devices disconnected. Displacements and strains were recorded at various locations along the mast length. 
In the ideal case, the applied transverse shear load is shared equally by two opposing faces of flexible battens. 

In summary, the mast behaved as predicted by the contractor for the linear regime of this test. 
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The axial-torsional test achieved an axial longeron compression load equivalent to that imposed by a 
73 000 in.-lb ultimate bending moment. A superimposed 1600 in.-lb torque load did not produce system buck- 
ling in the critically loaded longeron. In addition, displacements and strains were recorded at various locations 
along the mast length. Overall, the mast performed as predicted for the axial, shear, and axial-torsional tests. 

The BG-bearing life cycle test 1 objective was to verify a bearing life of 120 years under simulated and 
accelerated environmental and induced conditions. Retention of the structural and functional integrity of the 
bearings, without unacceptable degradation, demonstrates that the test article (fig. 15) is capable of sustaining 
the solar array assemblies through all anticipated and significant operational loads and environmental conditions. 
To date, there has only been one event during testing. The frictional torque on the horizontal unit exceeded 
75 in.-lb, which was higher than the specification limit, and the units were shut down. 

Toroid wedging is one of the leading theories that explain the increased frictional torque. The horizontal 
alignment of the beta axis means that the bearing is in a vertical plane (perpendicular to the axis of rotation). 
Since there is no cage in this bearing to maintain equal spacing in this orientation, gravity tends to pull the balls 
and toroid separators to the bottom, jamming them together where it is possible to generate higher friction. 

The test was restarted by reversing the direction of rotation for a few degrees, then resuming rotation in the 
original direction. This redistributed the balls and toroids, returning the torques to normal. The limit of the cur- 
rent drive motor in the test cell was determined to be capable of 360 in.-lb. The increased torque limit is caused 
by the balls rolling over fresh lubricant wear debris, which is normal for a solid lubricant instead of the balls 
and separators jamming. To date, torque spikes near 75 in.-lb have occurred, but there has been no trend of their 
increasing observed. The horizontal unit has accumulated an equivalent of 23 years of beta cycles. 

The BG-bearing life cycle 2 test examined the bearing subassembly for wearout and examined unanticipated 
failure modes associated with a mechanically moving assembly and the verification of the design against such 
deterioration. This test used a vertical unit and completed 37 successful weeks of testing to date. 


Integrated Equipment Assembly Qualification 

The EEA conditions and stores electric power collected by the PV arrays for use in SSF operations. The 
assembly supports on-orbit operations with either a complete or reduced energy storage subsystem complement 
and provides the framework to structurally, electrically, and thermally integrate the PV power module for launch 
and on-orbit operations. 

The IEA verification program assures that all requirements on the integrated hardware are satisfied prior to 
flight. Verification of the IEA consists of mass thermal-acoustic model testing prior to the PDR, engineering 
model testing, and qualification testing including EMI/EMC, thermal vacuum, structural, and electrical func- 
tional testing following the critical design review. 

The energy storage subsystem is verified at the IEA and battery levels. The subsystem consists of six Ni-H 2 
batteries, each with a dedicated battery control discharge unit as shown in figure 16. Integrated equipment assembly 
verification is performed without two of the batteries and BCDU’s in the test configuration. Because of weight 
considerations and low power requirements on the early stages of SSF, the batteries and BCDU’s are launched 
later. The PV power module battery consists of 76 Ni-H 2 cells (60 plates per cell) in series to produce the 95-V dc 
average discharge voltage. The cells are divided into 2 assemblies of 38 for packaging in the ORU box; therefore, 
each battery is composed of 2 battery subassembly ORU’s wired in series. During eclipse, the energy storage 
subsystem discharges stored energy to the dc power bus; during sunlight, it receives and stores energy collected 
by the solar arrays. 
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The verification of the thermal control system will be accomplished by a variety of analyses and tests. The 
ORU level heat loads are verified at its testing level and are used to verify the integrated TCS by analysis. The 
integrated TCS is also tested at the IE A thermal balance/vacuum qualification test. The test uses a simulator and 
subcontractor-conducted radiator panel thermal vacuum tests which anchor the analysis models. 


Mission Simulation Test 

A mission simulation test is planned at the NASA Lewis Space Power Facility in Plum Brook, Ohio. The 
test is designed to validate hardware and software at the PV module system level in the simulated operational 
environment. This thermal vacuum test is a demonstration with no pass/fail criteria applied. Data from this test 
will be used for PV module thermal model correlation, for comparison with the IEA thermal vacuum qualification 
test results and validation of software commands to the beta gimbal assembly/electronics control unit (BGA/ECU). 
The test will demonstrate 

PV module startup and operation after hot and cold soak 

PV module performance in simulated PMC on-orbit environmental conditions 

Shutdown and hot restart 

Beta gimbal command and control 

Thermal model calibration 

The PV module is tested in a cryoshroud (approx. 46 by 22 by 80 ft), which is scheduled for completion 
by June 1994. The Space Power Facility provides the thermal vacuum environment for the orbital simulation 
testing. The temperature environment includes an array of quartz lamp fixtures and cold walls. 

In addition, there is a qualification test of the PV module radiator in the cryoshroud prior to the mission 
simulation test. The PV radiator is an ORU consisting of a set of panels that reject waste heat to the space envi- 
ronment by thermal radiation. Liquid coolant conveys the heat to the radiator and circulates through channels 
embedded in honeycomb panels. This test demonstrates the deployment and retraction functions of the radiator 
in a thermal vacuum environment. 


ELECTRICAL POWER SYSTEM SOFTWARE VERIFICATION 

All EPS flight software verification activities are performed in the Central Test Facilities (CTF), located in 
Houston, Texas and in WP-04 test facilities. Following testing at the CTF, the verified software is delivered to 
a WP-04 facility for validation in a hardware and software integration test. Central Test Facilities provided soft- 
ware and DMS kits while WP-04 provided simulations to be used in the verification testing of the EPS flight 
software. Flight software validation at the WP-04 test facilities will use government-furnished equipment (GFE), 
CTF software, a DMS kit, the WP-04 simulations, and system hardware. The software verification tests are a 
series of interrelated tests that build on each other starting from the smallest unit, a computer software configu- 
ration item (CSCI), and culminate in a test with the entire EPS at SPEL/ESIT. 

The EPS flight software and control system is a hierarchical set of communicating processors and embedded 
controllers that manage and control the EPS. The highest level of control, tier I, issues commands including 
those received from the ground and crew. Tier II, which contains the highest level of EPS software, receives 
commands from and transmits data to tier I to other tier II systems, and to the two subordinate EPS tiers below 
tier II. The EPS tier II software application, power management controller application (PMCA), resides on a 
standard data processor. The PMCA controls two tier III applications: the photovoltaic controller application 
(PVCA) and the main bus controller application (MBCA). These applications primarily interface with the 
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PMCA and the tier IV firmware controllers internal to the EPS ORU’s. The PVCA controls all the ORU’s 
associated with the same PV module whereas the MBCA controls the primary power distribution network, 
including all EPS ORU’s not located on the PV module. 

As such, verification testing for those requirements applicable to software commands written by WP-04 for 
tiers III, IV, and some of II can be performed at WP-04 facilities. Tier II requirements that pertain to the communi- 
cations between the EPS and other SSF systems are verified at the CTF where all SSF systems software will be 
present. All WP-04 flight software is developed, modified, updated, and recorded at the Rocketdyne Software 
Production Facility (SWPF). The PMCA, PVCA, and MBCA are each made up of computer software 
configuration items (CSCI). Like an ORU, each CSCI is individually verified and acceptance tested. Verification 
tests are performed in the SWPF where specific tests show that the software correctly receives, transmits, and 
provides valid commands, collects data, and detects out-of-operational limits. 

Once the CSCI’s have been individually verified, they are verified as a system. This EPS software verifica- 
tion is conducted at the CTF. Here, the software and hardware required to support the testing are validated prior 
to WP-04 system software verification. The tier IV WP-04 firmware controllers are simulated. Many subtests 
are run where the management and control of EPS functions such as PV module temperature control, PV module 
fluid leak, and primary power voltage regulations are monitored through simulated sensor data. Upon receiving 
an expected output such as a voltage, current, pressure, temperature, or an on/off status indication in response to 
a test input, the operation is considered to be verified. 

The verified flight software from the CTF is then integrated in WP-04 system verification tests with the 
EM and qualification hardware at SPEL/ESIT. This testing validates that the hardware is compatible with the 
software while the system performance is verified. Pump and flow control subassembly and beta gimbal elec- 
tronics control unit (BGECU) functions are simulated at SPEL/ESIT because this hardware is not part of the 
EPS testbed. Photovoltaic control unit to pump and flow control subassembly (PFCS) control functions are vali- 
dated during IEA qualification tests which are part of the PV tests. During the mission simulation certification 
test at the SPF, the PVCU-to-BGECU functions are validated. The software verification tests are a series of 
interrelated tests that build on each other starting from the smallest CSCI unit and culminate in a test with the 
entire EPS at SPEL/ESIT. 

In an almost parallel effort to the software verification and validation activities, independent verification 
and validation of the EPS application software is conducted. The IV&V process ensures that the software has 
been properly implemented and complies with requirements during the verification phases. Through a series of 
independent test plans and scenarios, IV&V testing is performed on the same software and at the same facilities 
as the formal software verification activities. Independent verification and validation of the stand-alone PVCA 
and MBCA CSCI’s is conducted at the SWPF. The software is then moved to the CTF where the PMCA and 
the combined EPS CSCI’s are tested. EPS flight software and hardware integrated IV&V testing is completed at 
SPEL. 


Verification Activities to Date 

To date, no software verification has occurred. The establishment of a consolidated set of system software 
requirements occurred several months before the CDR. Test plans and procedures have been generated for each 
CSCI. 

The EPS simulation support software used at CSF is currently being developed. When complete, this soft- 
ware will be tested at Rocketdyne’ s Simlab to detect any errors before being sent to the CSF. Software errors 
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will be logged in discrepancy reports and the source code will be modified, requiring a rerunning of the affected 
test case. 

The testing will demonstrate compliance with requirements (functional tests), coding the software in accord- 
ance with applicable standards, and ensuring that unit decision outcome produces the desired results. These 
objectives will be accomplished through fault detection and recovery, erroneous input tests, timing tests, soft- 
ware interface tests, and transmitting or receiving proper commands. 


Central Test Facilities 

From lessons learned and steering groups/study teams, it was recommended that a test system for program 
level integration and certification be established to model the Shuttle Avionics Integration Laboratory (SAIL). 

As a result, the CTF’s were approved and combine all of the systems together in a simulation to perform software 
verification and system-to-system horizontal integration. This type of integration conducts limited station level 
functional and performance verifications, end-to-end software and avionics functionality, and interface verification. 
Certification of the CTF’s and the support hardware and software are completed prior to any formal testing. 

The Central Software and Central Avionics Facilities will remain in place to support on-orbit anomaly reso- 
lution for the life of the program and will be used to support the stage verification of the integrated flight soft- 
ware. The CAF verifies the interaction of flight software and avionics prior to flight such as the CSF on a stage- 
by-stage configuration level. This facility will provide a high-fidelity representation of SSF avionics using a 
combination of flightlike components and simulations. 

Work package-04 representatives on the CTF teams participate in planning and implementing a verification 
program that ensures EPS software test activities be completed. Work package-04 will use the CSF for flight 
software verification. The EPS flight software developed at Rocketdyne is transferred to the CSF facility for 
integrated EPS software verification and system-to-system verification. Errors encountered during testing are 
corrected by the accountable developer. The EPS tier IV firmware controllers are located in the CAF and there- 
fore are simulated in CSF with software applications that accept and respond to commands. In addition to the 
EPS software provided to the CTF’s, WP-04 provides primary power distribution simulations and firmware 
controllers, which will be contained in the BCDU, PFCS, and BGECU. As discussed in the Electrical Power 
System Software Verification section, each of these applications is validated at different WP-04 test facilities. 


ELECTRICAL POWER SYSTEM OPERATIONS VERIFICATION 

Electrical power system operations verification is performed during the prelaunch and on-orbit phases. Veri- 
fication consists of ensuring the hardware and software has a final ground inspection, installation into the shuttle 
for launch, initial activation and checkout on-orbit, and continual support including monitoring and maintenance. 

All SSFP elements are processed through Kennedy’s facilities to be configured for orbit delivery; the cargo 
element’s capability to function and interface with other assembly elements is verified. Photovoltaic modules and 
space trusses are delivered directly to Kennedy to be prepared for assembly launches aboard the shuttle. Before 
arriving at Kennedy, all other WP-04 hardware including DDCU’s, RPCM’s, MBSU’s, uninterruptible power 
supplies (UPS), and plasma contactors are outfitted and integrated in the elements that they will be launched 
with at other facilities. 

Upon arrival, the hardware receives an inspection on the PV module to ensure that no damage occurred 
during transportation. This includes a visual inspection and a sniff test of the environment around the NiH 2 
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batteries and ammonia coolant components. Instrumentation on board the cargo transportation system is checked 
and data outputs are verified to be within allowable transportation limits. The acceptance data package that 
accompanies the PV modules is reviewed for completeness, and any remaining open-work items are finished at 
Kennedy. 

Postdelivery verification (PDV) tests check the element’s functionality in a stand-alone configuration before 
integration with other elements. Ground support equipment (GSE) is used to power up hardware with controller 
components to verify that stand-alone testing of the PV module has ensured successful activation. Likewise, dis- 
tributed WP-04 hardware outfitted and integrated in other elements is functionally checked during the assembly 
element PDV tests. Work package-04 GSE, includes handling, packaging, transportation, servicing, and checkout 
equipment that is verified and certified before use with the flight hardware. This equipment must meet physical 
interface, load, pressure, mechanical functional, and electrical functional SSF support equipment requirements. 

Following PDV tests, integration testing with other available elements is performed. Current plans are to 
test the flight hardware and software that constitute the first two assembly launches. Following this test, a test 
will be conducted to combine flight hardware and software for assembly flights 3 to 6 with simulators for 
assembly flights 1 and 2. This combination will represent the first SSF full system level test for the man-tended 
configuration. The verification objectives for these tests are more thoroughly discussed in the Integrated Flight 
Elements Testing section. 

The PV module that is launched as part of the first cargo element is mated electrically and mechanically to 
the WP-02 portion of the cargo element. After all connections have been made, an interface verification test is 
performed to verify the newly mated interfaces. The test power is applied by the GSE to the WP-02 portion of 
the cargo element that flows through the cables and connectors to the PV module. When powered up, the PV 
module sends commands to the GSE where successful activation is verified. Additionally, electrical continuity 
checks are performed on the PV power cabling to verify expected performance characteristics. 

Last, before launch, a cargo element-to-orbiter interface verification test is performed. This test verifies the 
functionality between the cargo element and orbiter. The PV cargo element has no electrical interfaces with the 
orbiter nor does any other WP-04 hardware launched as part of other cargo elements; therefore, WP-04 involvement 
in this test is minimal. A visual test is performed to verify that no portion of the cargo element extend further 
than the allowable orbiter payload envelope. 

Electrical power system startup and stage-by-stage on-orbit operation are verified prior to launch at SPEL 
and Kennedy with the flight hardware. The purpose of this testing is to ensure that the system is operating as 
designed by verifying that the hardware correctly accepts and carries out commands sent by the on-board crew 
or ground controllers. The Electrical System Division Verification Results to Date and Integrated Flight Element 
Testing sections provide information about the SPEL and Kennedy verification processes. Overall EPS perform- 
ance assessments are made frequently with data received from monitoring ORU’s and are available through the 
Engineering Support Center (ESC). Electrical power system startup is verified by monitoring selected parameters 
(e.g., voltage and current) as each ORU is activated and its functionality examined. Plans to verify the power 
capability requirements of the EPS with on-orbit tests are currently being worked out. Sustaining engineering 
and on-orbit anomaly resolution is supported by the ESC and the electrical testbed at the Lewis PSF. 
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Verification Activities to Date 


Maintenance tasks and neutral buoyancy tests of the PV module EVA assembly were performed and com- 
pleted at Johnson and Marshall during the development phase (fig. 17). The test subjects were astronauts, 

WP-02 engineers responsible for providing EVA support equipment and WP-04 engineers responsible for 
developing task operation procedures (fig. 18). The primary emphasis of the tests was to assess the CDR design 
by evaluating and demonstrating PV module assembly tasks and ORU removal and reinstallation activities. Dif- 
ferent methods of removal and reinstallation were performed to determine optimum operations. Feedback 
received from the test focused on human-factor-related features. For example, positioning test subjects to facili- 
tate performance of a given task included locating handholds for crew translation around the PV module and 
portable foot restraint (PFR) positioning for crew and tool access to the ORU work area. Recommendations for 
design enhancements were directed toward visual and/or tactual cues or displays to identify the work area, to 
align the ORU’s, and to signal completion or status of a task. Other comments were received on fastener selec- 
tion and tools designed to aid in the removal of the WP-04 ORU’s. 

The test team was confident that all procedures could be performed successfully. Any recommendations and 
problems encountered during the tests were reviewed by the test team at the completion of each run. The results 
were presented to ORU design teams and, in some cases, were carried forward as part of the WP-04 ORU CDR’s. 

In addition to the EVA tests conducted to support the evaluation of the CDR design, several WP-04 robotic 
ORU removal and replacement tests were performed (fig. 19). These tests simulated the proposed capabilities of 
the Canadian robot used to changeout SSF ORU’s in the zero-g environment. The tests focused on the mating 
and demating of ORU’s with the associated alignment guides and status indications. Since results indicate opti- 
mal camera views and cues are crucial to the success of the changeout tasks, the tests also investigated the 
occurrence any constraining camera views of assembly activities. Like the EVA tests, all of the robotic tests 
were successful and provided data on the removal and replacement procedures for ORU’s. 

Current verification plans for PV module and EPS ORU assembly and maintenance tasks are to perform a 
combination of computer graphic analyses and simulations, 1-g, robotic, and neutral buoyancy tests and/or 
demonstrations. These verification activities are performed in accordance with established assembly and main- 
tenance procedures derived during the development phase. Certification of the on-orbit assembly and mainte- 
nance tasks is complete when all established procedures have been successfully verified. 


Integrated Flight Elements Testing 

Successful interface and functional verification testing proves that discrete flight elements have been inte- 
grated. The first two assembly launches in a stage 2 test and assembly flight elements 3 to 6 tested in the man- 
tended configuration (both at Kennedy) indicate that these flight elements are available for integrated testing. 

The stage 2 test is the only time when the flight PV module interfaces with another flight element on the 
ground. This test verifies the functionality of the systems present on each element, the continuity tests of the 
interfaces, and simulation of the activation and startup operation. The initial station activation of all equipment 
on both flight elements is performed on the ground with the exception of PV module deployments and full 
battery charging. 

Ground support equipment is used to send power and data commands to the PV module to initialize and 
power up its controller (the PVCA); the ORU boxes are then checked out sequentially for channel 1. The PV 
TCS is activated and checked out during channel 1 operations. The TCS continues to operate circulating ammonia 
for the remainder of the test through the undeployed radiator to provide ORU box cooling. At the completion of 
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channel 1 initialization and checkout, the same steps are repeated for channel 3. Other systems and elements that 
are functionally tested during the stage 2 test include the GN&C, C&T, and the mobile transporter. 

The incremental launch schedule was adjusted to furnish an interval at Kennedy that will provide for a test 
of the man-tended configuration. The test will include flight hardware and software for assembly flights 3 to 6 
and dedicated test articles (DTA’s) representing flights 1 and 2. This test hard mates the flight-to-flight 
hardware to ensure interface verification. Additionally, this is the only test where verification of functional paths 
for station-critical systems including orbiter-to-station simulations is accomplished. 

The PV DTA is delivered to Kennedy following structural test activities at Johnson. Engineering model 
ORU’s are outfitted on the PV DTA in support of the integrated flight tests. Work package-04 flight hardware 
on assembly flight elements 3 to 6 includes DDCU’s, MBSU’s, RPCM’s, UPS’s, and plasma contactors. These 
are tested as part of the functional path test at partial power to acceptance test levels. This work package testing 
of the EPS to demonstrate and verify end-to-end power hardware integration and performance through the MTC 
configuration is accomplished during SPEL/ESIT as described in the Electrical System Integrated Test section. 


CONCLUSION 

The Electrical Power System’s verification program was defined and documented in the electrical power 
system’s Master Verification Plan. Verification activities were conducted as scheduled in the development phase 
of the program, and the results were as predicted. These tests were performed primarily on breadboard hardware 
to provide the necessary proof-of-concept information prior to flight hardware fabrication. 

In conclusion, the electrical power system Critical Design Review was held in February 1993 and the majority 
of the review item discrepancies reports related to verification have already been completed and incorporated 
into a revised version of the Master Verification Plan. The electrical power system verification program is ready 
for the qualification of the hardware and software, which is the next phase of the program. 
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LIST OF ACRONYMS 


ACD 

architectural control document 

BCDU 

battery control discharge unit 

BG 

beta gimbal 

BGA 

beta gimbal assembly 

BGECU 

beta gimbal electronics control unit 

BGTS 

beta gimbal transition structure 

C&T 

communications and tracking 

CAF 

Central Avionics Facility 

CDR 

critical design review 

CIL 

critical items list 

CoFR 

Certification of Flight Readiness 

CSA 

Canadian Space Agency 

CSCI 

computer software configuration item 

CSD 

contract sign date 

CSF 

Central Software Facility 

CTF 

Central Test Facilities 

DCR 

design certification review 

DCSU 

direct-current switching unit 

DDCU 

direct current to direct current converter unit 

DMS 

data management system 

DSA 

Distributed System Architects 

DTA 

dedicated test article 

ECLSS 

environmental control and life support system 

ECU 

electronics control unit 

EM 

engineering model 

EMC 

electromagnetic compatibility 

EMI 

electromagnetic interference 

EPS 

electric power system 

ESA 

European Space Agency 

ESC 

Engineering Support Center 

ESD 

Electrical Systems Division 

ESIT 

electrical system integrated test 
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EVA 

extravehicular activity 

EVAS 

extravehicular activity system 

FEL 

first elements launch 

FMEA 

failure modes and effects analysis 

FSE 

flight support equipment 

GAO 

Government Accounting Office 

GFE 

government-furnished equipment 

GN&C 

guidance, navigation, and control 

GSE 

ground support equipment 

IACO 

integrated assembly and checkout 

IEA 

integrated equipment assembly 

IG 

Inspector General 

IV&V 

independent verification and validation 

MBCA 

main bus controller application 

MBSU 

main bus switching unit 

MOPO 

Mission Operations Planning Office 

MS 

man systems 

MTC 

man-tended capabilities 

MVDS 

master verification data base system 

MVP 

master verification plan 

NASDA 

National Space Development Agency of Japan 

NSTS 

National Space Transportation System 

OPS 

operations 

ORU 

orbital replacement unit 

OSE 

orbital support equipment 

PDR 

preliminary design review 

PDRD 

Program Definition and Requirements Document 

PDV 

postdelivery verification 

PFCS 

pump and flow control subassembly 

PFR 

portable foot restraint 

PIP 

payload integration plan 

PMAD 

power management and distribution 

PMC 

permanent manned capability 

PMCA 

power management controller application 
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PMVP 

Program Master Verification Plan 

PSF 

Power Systems Facility 

PV 

photovoltaic 

PVAA 

photovoltaic array assembly 

PVCA 

photovoltaic controller application 

PVCU 

photovoltaic controller unit 

PVP 

Program Verification Panel 

RID 

review item discrepancy 

RPCM 

remote power controller module 

SAIL 

Shuttle Avionics Integration Laboratory 

SE&I 

Systems Engineering and Integration 

SPEL 

Space Power Electronics Laboratory 

SPF 

Space Power Facility 

SPM 

solar power module 

SSF 

Space Station Freedom 

SSFP 

Space Station Freedom Program 

SSFPP 

Space Station Freedom Program participants 

SSP 

Space Station Program 

SSU 

sequential shunt unit 

SWPF 

Software Production Facility (Rocketdyne) 

TCS 

thermal control system 

TD 

technical discipline 

TMIS 

technical and management information system 

TSE 

test support equipment 

UPS 

uninterruptible power supplies 

WETF 

Weightless Environment Test Facility 

WP 

work package 
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Figure 1 . — Space Station Freedom. 



Figure 2. — U.S. laboratory mockup. 
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Figure 3. — Verification program summary. 
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Figure 4.— Electrical power system verification process overview and work package-02 cargo. 
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Figure 6. — Space Station Freedom program organization. 
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Figure 7.-Space Station Freedom program 
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Figure 11. — Space power electronics laboratory SPEL test 1 configuration. 
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Figure 12. — Space power electronics laboratory SPEL test 2 configuration. 
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Figure 1 3. — Space power electronics laboratory SPEL test 3 configuration. 


28 



Figure 1 4. — FASTMast test hardware. 
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Figure 1 6— Integrated equipment assembly. 
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Figure 17. — Neutral buoyancy photovoltaic module mockup. 



Figure 1 8. — Neutral buoyancy test subject. 
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Figure 1 9. — Orbital replacement unit robotic testing. 
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